The cybercrime group ShinyHunters claimed responsibility for a cyberattack on the web-based educational platform Canvas, the group said, while service to the system was partially restored. ShinyHunters said it had stolen 3.5 terabytes of data, including names, email addresses, student ID numbers, and private messages, and threatened to release the material if ransoms were not paid by May 12.

On May 5, ShinyHunters posted a message saying Instructure had not spoken to the group about preventing a data leak and that its ransom demand was lower than expected. It is not clear if a ransom was paid. ShinyHunters is a global cybercrime syndicate that was established in 2019.

Instructure said on its website that Canvas was now available for most users and that no incidents were reported on Saturday. The countries affected by the outage include the United States, the Netherlands, Sweden, Australia, and the United Kingdom. About 30 million people across the globe use the Canvas system, according to Canvas, and the breach targeted close to 9,000 institutions globally.

The Federal Bureau of Investigation said it was aware of a service disruption impacting a learning system. "This disruption has impacted schools, educational institutions, and students across the country," the FBI said.

Penn State, Harvard University, the University of Illinois, Columbia University, and Georgetown University are extending or changing exam deadlines because of the Canvas outage. The University of Cambridge temporarily suspended access to Canvas on Friday.

The University of Sydney reported that Canvas had been restored but was not yet accessible to staff or students because checks still needed to be completed. The University of Alberta said Canvas was partially restored with reduced functionality.